Environment providers move workspace and machine lifecycle into plugins.

1. Overview

At main (06aeaa9949), core server and daemon code provisioned exactly three workspace kinds on user-enrolled hosts: managed worktrees, personal workspaces, and unmanaged checkouts. The branch makes provisioning extensible: the server owns policy and durable orchestration; plugins own environment or machine mechanics; the daemon retains only host-local inspection and process primitives.

Sources: exact compare, branch summary, migration 0113, plan CURRENT, and the F17/F19/F20 review outputs. Main-baseline claims were reverified at the rebased base with git show 06aeaa9949:packages/domain/src/environment.ts, git show 06aeaa9949:packages/domain/src/host.ts, git show 06aeaa9949:packages/db/src/schema.ts, git show 06aeaa9949:packages/host-daemon-contract/src/protocol.ts, and git show 06aeaa9949:packages/plugin-sdk/package.json; git ls-tree 06aeaa9949:packages/db/drizzle confirmed that main ends at migration 0112.

2. Reviewer’s map

Read the eight commits in order. API Core establishes the wire, persistence, recovery, and UI host surfaces; the next four commits add providers; the last three remove the SSH machine plugin, repair the path-less migration backfill, and delete an intermediate-state backfill that main never needed.

Area footprint and suggested reading order

Provider plugin size

Tree lines count tracked TypeScript/TSX source and test files at the final commit; source excludes test files and Vitest configuration. Diff-added is the rename-aware exact-base diff. Git counts several worktree-plugin files moved from host-workspace as renames, so its diff-added number undercounts the code present at HEAD.

Core behavior removed or displaced from main

Baseline scope: hostless/ephemeral provider paths, an Environments settings page and fields, and an isolate/inherit sub-thread setting were added and removed in intermediate branch states. Main had none of them, so they are not deletions from main.

Counts are recomputed from git diff --numstat 06aeaa9949..7e1ed2fdb3; commit stats from git log --stat. No generated or untracked plan file is counted.

3. API and data model

The contracts deliberately separate durable server orchestration from plugin mechanics. Inputs are JSON-schema validated at the boundary; plugin resource values are private, bounded handles used only for replay and teardown. Removed surfaces below are compared only with main at 06aeaa9949, not with intermediate branch states.

interface PluginEnvironmentProviderPolicy {
  retireGraceMs: number | null
  removeRetryMs: number
  transientRetryMs: number
  transientRetryLimit: number
  pathKeys: "per-thread" | "per-attempt"
  createTimeoutMs: number | null
}

type EnvironmentCreated = {
  status: "created"
  path: string
  ownsPath: boolean
  mergeBaseBranch?: string
  resource?: JsonValue
}

interface PluginEnvironmentProviderDefinition<R, S> {
  id: string
  displayName: string
  icon?: string
  requires?: R
  inputs?: S
  policy?: Partial<PluginEnvironmentProviderPolicy>
  availability?: (context) => Promise<ProviderAvailability>
  validate?: (context) => Promise<ValidateDecision>
  create(context: EnvironmentCreateContext<S>): Promise<EnvironmentCreated | ProviderFailed>
  remove(context: EnvironmentRemoveContext): Promise<ProviderRemoved | ProviderFailed>
}

type MachinePolicy = {
  idleSuspendMs: number | null
  retire: { after: "last-thread"; graceMs: number } | { after: "never" }
  removeRetryMs: number
}

type MachineCreated<R extends JsonValue> = {
  status: "created"
  hostId: string
  resource: R
}

interface PluginMachineProviderDefinition<R, S> {
  id: string
  displayName: string
  icon?: string
  requires?: R
  inputs?: S
  availability?: (context) => Promise<ProviderAvailability>
  validate?: (context) => Promise<ValidateDecision>
  environmentRow?: { displayName: string; environmentProviderId: string }
  policy: MachinePolicy
  create(context: MachineCreateContext<S>): Promise<MachineCreated<R> | ProviderFailed>
  suspend?: (context: SuspendContext) => Promise<{ resource: JsonValue }>
  resume?: (context: LifecycleContext) => Promise<{ resource: JsonValue }>
  remove(context: LifecycleContext): Promise<ProviderRemoved | ProviderFailed>
  }

Request and selection shapes

type EnvironmentMachineSelection =
  | { type: "existing"; hostId: string }
  | { type: "new"; machineProviderId: string; inputs: JsonValue | null }

type ProviderEnvironmentArgs = {
  type: "provider"
  environmentProviderId: string
  machine: EnvironmentMachineSelection
  inputs: JsonValue | null
}

// Server-boundary compatibility sugars retained for one cycle:
// { type: "managed-worktree" | "personal" | "unmanaged" | "host", ... }

Removed and compatibility fields

Migration 0113

Primary sources: environment-provider.ts, machine-provider.ts, 0113 migration, API audit docket.

4. Before / after screenshots

The matrix is driven by ?device=desktop|mobile&state=compact|expanded&surface=…. “Before” represents the rebased main baseline at 06aeaa9949; “After” represents the final 7e1ed2fdb3 UI. The screenshot set was captured during the pre-rebase b194187a7c review run; the rebase changed the pins and baseline, not the pictured provider surfaces. Click any image for its original capture. Provider-only surfaces use an explicit no-counterpart card.

5. User-facing changes

Each row ties the visible behavior to the plan decision or final review round that owns it. “Parity” means main’s user intent is preserved even when implementation moved into a plugin.

6. Bugs found and fixed during review

This is the reviewer-facing chronology from the standing reviewer and plan rounds. Every failure below describes an intermediate branch state that was fixed or removed before 7e1ed2fdb3; none is presented as behavior from main. Each line states the failure mode, not merely the patch. Final standing-review result: CLEAN.

Live QA matrices

Evidence: standing reviewer output; visual-review rounds through F20; final verification; F17, F19, F20, and migration-dry-run thread outputs; plan Rounds log.

7. Breaking changes and known issues

These are review constraints, intentional compatibility limits, and known parity behaviors—not untriaged findings.

8. Deferred follow-ups

Plan sections C/D were intentionally kept out of this eight-commit branch.

Source: untracked plans/environment-providers.md, sections C/D and Decisions log. The plan was read only and remains untracked.